you can use @parameter for this. here is the updated code for you
SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["conString"].ConnectionString);
SqlCommand cmd;
protected void Button1_Click(object sender, EventArgs e)
{
con.Open();
string query1 = "UPDATE table1 SET title=@title, departmenthead=@departmenthead, fax=@fax, address=@address where username = @username";
cmd = new SqlCommand(query1, con);
cmd.CommandType = CommandType.Text;
cmd.AddWithValue("@title", txttitle.Text);
cmd.AddWithValue("@user", txtuser.Text);
cmd.AddWithValue("@departmenthead", txtdeartment.Text);
cmd.AddWithValue("@fax", txtfax.Text);
cmd.AddWithValue("@address", txtaddress.Text);
//Execute Query
cmd.ExecuteNonQuery();
cmd.Parameters.Clear();
con.Close();
Hope this will help you